In-Vehicle Log Data Prioritization for Cyber-Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Connected vehicles face challenges in managing the increasing volume of log information and sensor data due to limited computational resources, making it difficult to detect cyber-attacks effectively while minimizing communication and storage loads.
Innovation Solution
A system that prioritizes and filters log data based on anomaly scores and transmission rules, allowing only critical data to be transmitted to a monitoring server, where high computational resources can process it, while reducing the load on in-vehicle devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If all log information and sensor data are uploaded to the server for anomaly detection, then the detection accuracy is improved, but the communication load and storage requirements in the vehicle increase significantly
Solution Approach 1:
The patent applies local quality by making different parts of the data processing system have different functions: the in-vehicle device performs local preprocessing and filtering of log data based on anomaly scores, while the server performs comprehensive anomaly detection. This division allows critical data to be uploaded for accurate detection while reducing overall communication load.
Solution Approach 2:
The patent implements preliminary action by performing anomaly scoring and data filtering at the in-vehicle device before uploading to the server. The log data is pre-processed locally to identify and prioritize anomalous entries, so that only relevant data needs to be transmitted, reducing communication load while maintaining detection effectiveness.
2Reliability
If comprehensive log data is stored in the in-vehicle device for analysis, then the anomaly detection capability is improved, but the storage requirements and computational load on the vehicle increase
Solution Approach 1:
The patent applies segmentation by dividing the anomaly detection system into two segments: a lightweight in-vehicle component that performs log collection and preliminary anomaly scoring, and a comprehensive server component that performs detailed anomaly detection and analysis. This segmentation allows each part to operate within its computational capabilities while achieving overall reliable detection.
Solution Approach 2:
The patent introduces an intermediary approach where the in-vehicle device acts as a mediator between data generation and server analysis. It performs intermediate processing by calculating anomaly scores and filtering logs before transmission, reducing the burden on both the vehicle's storage/computation and the server's communication interface.
3Measurement precision
If anomaly detection processing is performed entirely on the cloud server, then the detection accuracy is improved, but the response time and latency increase
Solution Approach 1:
The patent implements preliminary action by performing anomaly scoring and data filtering at the in-vehicle device before uploading to the server. The log data is pre-processed locally to identify and prioritize anomalous entries, so that only relevant data needs to be transmitted, reducing communication load while maintaining detection effectiveness.
4Speed
If more computational resources are allocated to in-vehicle devices for real-time anomaly detection, then the response speed is improved, but the device complexity and cost increase
Solution Approach 1:
The patent applies segmentation by dividing the anomaly detection system into two segments: a lightweight in-vehicle component that performs log collection and preliminary anomaly scoring, and a comprehensive server component that performs detailed anomaly detection and analysis. This segmentation allows each part to operate within its computational capabilities while achieving overall reliable detection.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A device includes a first determination unit configured to determine, for each data item generated in a device, a priority upon transmitting said each data item to an information processing apparatus, based on one or more rules set in advance; a second determination unit configured to determine, for said each data item, whether or not it is necessary to transmit said each data item to the information processing apparatus, based on the priority determined for said each data item; and a transmission unit configured to transmit a data item to the information processing apparatus among data items generated in the device for a predetermined period of time, the data item being determined by the second determination unit that it is necessary to transmit the data item to the information processing apparatus, so as to reduce the communication load due to data generated in the device.